Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
summary
A Hyper‑V IDE emulation bug gives a relative 32‑bit read/write primitive: attacker‑controlled 23 high bits from a 512‑aligned drive offset plus 9 low bits from a current‑byte counter. The exploit maps virtual alloc layout and vram aperture to leak heap/ntdll/kernel32 addresses, builds an RPC NDR-based loop plus a memcpy gadget to copy an IAT entry across reboots, then patches CFG checks to gain code execution on Server 2012R2 and Windows 10 1709 with varying reliability.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:40The story of the vulnerability
- 7:06The bug
- 11:45Constraints
- 14:35Memory Layout
- 19:17Demo
- 20:42Windows 10 1709
- 23:42Ideas
- 24:23First Attempt
- 28:35VideoDirtListener
- 30:25Looping in Direct Caller
- 31:53RPC Server Call2
- 33:44MemCopy Gadget
- 34:20Strategy
- 40:06Raw payload
- 40:38Raw payload demo
- 41:41Second payload
- 43:03VM Worker
- 43:48Lessons Learned
- 45:34Language Safety
- 46:32Bug Elimination
- 46:51Virtualization Sandbox
- 50:03Outro
related talks
33mExploring a New Class of Kernel Exploit Primitive
55mLessons Learned from Eight Years of Breaking Hypervisors
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
52mA New CVE-2015-0057 Exploit Technology
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
25mData-Only Pwning Microsoft Windows Kernel